Security help how can I stop from this happening again

[samraz972]

Someone joined my website and all users need to approve their email
this person
wasnt approved and somehow he pmd everyone in the last 24 hrs to join the site.
Please help.

--------------- Added [DATE]1238120610[/DATE] at [TIME]1238120610[/TIME] ---------------

hes sending me this email
You really want to play this game? Apologies now or we will never stop.. trust me, you think you know more than me? My next spam pm on your forum will be an ultimate one it will also include a picture with all the pm's, this picture is a sexy picture.

Apologies now and kiss my feet before the next wave comes. The next wave will be even more hurtful trust me.

The Asian Place
----------------------------------
e: webmaster@theasianplace.net
w: www.theasianplace.net

Save a tree... please don't print this e-mail unless you really need to.

[ssslippy]

Do you have an automatic promotion setup?

Double check unconfirmed user permissions.

[TigerC10]

Private Messages are enabled for your "Users Awaiting E-mail Confirmation" group. This is enabled by default so that if someone has trouble confirming their e-mails they can PM an admin about it.

Anyway, just edit that usergroup and remove the private message option.

[samraz972]

somethings not right here
users waiting email confirmation
are only allowed to pm admins right
he found some loophole to pm more then 70 members
thats not right
when even regular users can only send 5

and no whats automatic promotion

[Lynne]

Originally Posted by samraz972

somethings not right here
users waiting email confirmation
are only allowed to pm admins right

No, not true at all. There is no setting to say you may only PM admins.

[TigerC10]

Yeah, they are allowed to use Private Messaging so that they can contact admins - they're not restricted to only contacting admins.